Gobox Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gobox Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server wrapping the Gobox Open API (dev-api.gobox.asia/open/api/*) for AI agents, Claude Desktop, and CLI automation.
sku_full_status)tools/Contact Gobox admin for client_id + client_secret.
cd gobox-mcp
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
# Edit .env with your credentialspython gobox_mcp.pydocker compose up -d
# Test: curl http://localhost:8000/sseEdit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"gobox": {
"command": "/absolute/path/to/gobox-mcp/.venv/bin/python",
"args": ["/absolute/path/to/gobox-mcp/gobox_mcp.py"],
"env": {
"GOBOX_BASE_URL": "https://dev-api.gobox.asia",
"GOBOX_CLIENT_ID": "xxx",
"GOBOX_CLIENT_SECRET": "xxx"
}
}
}
}{
"mcpServers": {
"gobox": {
"url": "http://localhost:8000/sse"
}
}
}claude mcp add gobox \
/absolute/path/.venv/bin/python \
/absolute/path/gobox_mcp.py \
-e GOBOX_BASE_URL=https://dev-api.gobox.asia \
-e GOBOX_CLIENT_ID=xxx \
-e GOBOX_CLIENT_SECRET=xxxSet GOBOX_BASE_URL to switch:
https://dev-api.gobox.asiahttps://api.gobox.asia (verify actual prod URL)| Module | Tools |
|---|---|
orders_tools | list_orders, get_order, create_order, update_order, update_order_status, cancel_order, send_order_to_goship |
products_tools | list_products, get_product, list_categories, list_brands, list_attributes, sku_quantity_available, sku_quantity_in_warehouse, sku_quantity_keep_pick, sku_quantity_wait_qc, sku_quantity_wait_incoming, sku_full_status |
warehouses_tools | list_warehouses, list_inventories, list_warehouse_pickings |
reports_tools | report_warehouse_import, report_warehouse_import_refund, report_export_by_order, report_export_by_sku, report_inventories, report_warehouse_store, report_warehouse_stock, report_materials |
shops_tools | list_shops |
locations_tools | list_cities, list_districts, list_wards, list_countries, get_sys_helpers |
consignments_tools | list_consignments, get_consignment, create_consignment, cancel_consignment |
goship_tools | get_shipping_rates |
webhooks_tools | list_webhooks, create_webhook, update_webhook, delete_webhook, toggle_webhook |
"List all Gobox warehouses" "Check stock for SKU ABC123" → calls sku_full_status("ABC123") "Có bao nhiêu đơn Shopee chưa giao hôm nay?" "Báo cáo nhập kho tháng này"OAuth fails: Verify GOBOX_GRANT_TYPE (default client_credentials). Contact admin if unsure.
FastMCP SSE DNS rebinding error: Add transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False) to mcp.run() call.
Token expired mid-call: Auto-refresh handles this. If persists, call gobox_auth.clear_cache().
gobox-mcp/
├── gobox_mcp.py # Main entry
├── gobox_auth.py # OAuth token cache
├── gobox_client.py # HTTP helper
├── tools/
│ ├── orders_tools.py
│ ├── products_tools.py
│ ├── warehouses_tools.py
│ ├── reports_tools.py
│ ├── shops_tools.py
│ ├── locations_tools.py
│ ├── consignments_tools.py
│ ├── goship_tools.py
│ └── webhooks_tools.py
├── Dockerfile
├── docker-compose.yml
├── requirements.txt
├── .env.example
└── README.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.